{"id":"CVE-2024-39325","aliases":["EUVD-2024-2380","GHSA-m9gv-6p22-qgmj"],"status":"published","title":"aimeos/ai-controller-frontend doesn't reset payment status in basket","description":"aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0043,"percentile":0.37648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-841"],"published":"2024-07-02T20:36:58Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","fixed_in":["2023.10.9","2022.10.8","2021.10.8","2020.10.15"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2023.04.1"},{"fixed":"2023.10.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2022.04.1"},{"fixed":"2022.10.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2021.04.1"},{"fixed":"2021.10.8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10.15"}]}]},{"source":"osv","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2023.04.1"},{"fixed":"2023.10.9"}]}],"versions":["2023.04.1","2023.04.2","2023.07.1","2023.10.1","2023.10.2","2023.10.3","2023.10.4","2023.10.5","2023.10.6","2023.10.7","2023.10.8"]},{"source":"osv","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2022.04.1"},{"fixed":"2022.10.8"}]}],"versions":["2022.04.1","2022.04.2","2022.04.3","2022.04.4","2022.04.5","2022.07.1","2022.07.2","2022.07.3","2022.10.1","2022.10.2","2022.10.3","2022.10.4","2022.10.5","2022.10.6","2022.10.7"]},{"source":"osv","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2021.04.1"},{"fixed":"2021.10.8"}]}],"versions":["2021.04.1","2021.04.2","2021.04.3","2021.04.4","2021.04.5","2021.07.1","2021.07.2","2021.10.1","2021.10.2","2021.10.3","2021.10.4","2021.10.5","2021.10.6","2021.10.7"]},{"source":"osv","ecosystem":"Packagist","package":"aimeos/ai-controller-frontend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020.10.15"}]}],"versions":["2016.07.1","2016.07.2","2016.07.3","2016.10.1","2016.10.2","2016.10.3","2016.10.4","2016.10.5","2016.10.6","2017.01.1","2017.01.2","2017.04.1","2017.04.2","2017.04.3","2017.04.4","2017.04.5","2017.04.6","2017.04.7","2017.07.1","2017.07.2","2017.07.3","2017.10.1","2017.10.2","2017.10.3","2017.10.4","2017.10.5","2018.01.1","2018.01.2","2018.04.1","2018.04.2","2018.04.3","2018.07.1","2018.07.2","2018.07.3","2018.07.4","2018.07.5","2018.07.6","2018.10.1","2018.10.2","2018.10.3","2018.10.4","2018.10.5","2018.10.6","2018.10.7","2018.10.8","2018.10.9","2019.01.1","2019.01.2","2019.04.1","2019.04.2","2019.04.3","2019.04.4","2019.04.5","2019.07.1","2019.07.2","2019.07.3","2019.07.4","2019.07.5","2019.10.1","2019.10.10","2019.10.11","2019.10.12","2019.10.13","2019.10.14","2019.10.15","2019.10.16","2019.10.2","2019.10.3","2019.10.4","2019.10.5","2019.10.6","2019.10.7","2019.10.8","2019.10.9","2020.01.1","2020.01.2","2020.04.1","2020.07.1","2020.07.2","2020.10.1","2020.10.10","2020.10.11","2020.10.12","2020.10.13","2020.10.14","2020.10.2","2020.10.3","2020.10.4","2020.10.5","2020.10.6","2020.10.7","2020.10.8","2020.10.9"]}],"products":[{"vendor":"aimeos","product":"ai-controller-frontend"},{"vendor":"aimeos","product":"aimeos_frontend_controller"}],"references":[{"url":"https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-m9gv-6p22-qgmj","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/aimeos/ai-controller-frontend/commit/b1960c0b6e5ee93111a5360c9ce949b3e7528cf7","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2932c113eb855","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39325","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m9gv-6p22-qgmj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39325.json","tags":["advisory"]},{"url":"https://github.com/aimeos/ai-controller-frontend","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-39325","title":"aimeos/ai-controller-frontend doesn't reset payment status in basket","description":"aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.\n","status":"published","published":"2024-07-02T20:36:58.336Z","modified":"2024-08-02T04:19:20.638Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-841"],"updated_at":"2026-11-02T14:34:19.28149Z"}],"euvd":[{"id":"EUVD-2024-2380","description":"aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.\n","status":"published","published":"2024-07-02T20:36:58Z","modified":"2024-08-02T04:19:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"ghsa":[{"id":"GHSA-m9gv-6p22-qgmj","title":"ai-controller-frontend payment status in basket isn't reset","description":"### Impact\nPayment status in basket isn't reset\n","status":"published","published":"2024-07-05T20:08:44Z","modified":"2024-07-05T20:08:45Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-841"],"updated_at":"2026-11-02T14:37:55.455438Z"}],"nvd":[{"id":"CVE-2024-39325","description":"aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.\n","status":"published","published":"2024-07-02T21:15:11.433Z","modified":"2026-06-17T07:41:43.157Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-841"],"updated_at":"2026-11-02T14:10:10.545705Z"}],"osv":[{"id":"CVE-2024-39325","title":"aimeos/ai-controller-frontend doesn't reset payment status in basket","description":"aimeos/ai-controller-frontend is the  Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.\n","status":"published","published":"2024-07-02T20:36:58.336Z","modified":"2026-10-28T02:30:55.560894321Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-841"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-m9gv-6p22-qgmj","title":"ai-controller-frontend payment status in basket isn't reset","description":"### Impact\nPayment status in basket isn't reset\n","status":"published","published":"2024-07-05T20:08:44Z","modified":"2024-07-05T20:27:33.700881Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-841"],"updated_at":"2026-11-02T15:46:51.811331Z"}]}}